When a national cyber agency says something is “highly likely,” it isn’t speculating. It’s using a calibrated probability term. So when the UK’s National Cyber Security Centre warned that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028, it was telling operators to plan for it, not just worry about it.
The claim comes from the NCSC’s Annual Review 2026. The agency says AI will raise the scale and efficiency of ransomware, social engineering and vulnerability exploitation. In its words: “It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI.” CNI covers the systems that keep the country running, such as energy, water, transport and health.
Note what the report does not say. As reported, there is no technical detail on what “AI-powered malware” actually means. Is it code that adapts on the fly? Or is it ordinary malware built faster, with phishing lures written by language models? Those are very different threats, and the vague label lets both fit. Readers should treat the 2028 date as a judgment call, not a measurement.
Still, the direction is hard to argue with. The NCSC also says China, Russia and other states will use “AI cyber” to pursue geopolitical goals, increasing the speed and scale of attacks on the UK. Faster exploitation of known vulnerabilities is the part that should worry defenders most, because patch cycles in infrastructure are slow. Old industrial systems can’t be updated overnight.
The review also covers a more personal threat. The NCSC saw persistent spear-phishing against high-risk individuals and growing efforts to compromise messaging apps. That matches a March warning from Dutch intelligence agencies, which said Russian state hackers were targeting officials, military personnel and civil servants worldwide. Attackers posed as Signal support to hijack accounts.
That detail matters for ordinary users. The attack didn’t break Signal’s encryption. It tricked people. Strong cryptography does nothing if someone hands over a verification code to a fake support agent. And AI makes that kind of impersonation cheaper, more fluent and easier to run against thousands of targets at once.
The NCSC put it plainly: “Technology has always influenced cyber security. What is different today is the pace.” Pace is the real issue. Defenders can’t assume attackers will stay slow while organizations take months to patch and train staff.
What should people do? Treat any unsolicited message from “support” as hostile. Never share codes. Turn on registration locks and review linked devices in your messaging apps. And if you work near infrastructure, assume the phishing email you receive next year will be better written than the one you got this year.